OpenHarness - Cross-Session Disclosure via /resume and /summary Commands

OpenHarness gateway allows anyone with access to shared channels to view other users' saved session data (snapshots) containing private information like passwords and files. This happens because two commands (/resume and /summary) are set to allow remote access by default.

The /resume and /summary commands in OpenHarness ohmo gateway have remote_invocable set to True by default, enabling authenticated remote actors to enumerate and instantiate arbitrary session snapshots by ID within shared gateway channels. This disclosure vulnerability exposes sensitive data including private prompts, credentials, tool outputs, and file paths from victim sessions without additional authorization checks.